qontract-reconcile 0.10.0__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/openshift_tekton_resources.py

@@ -1,11 +1,8 @@
 import json
 import logging
 import sys
-from typing import (
-    Any,
-    Optional,
-    Union,
-)
+from collections.abc import Mapping
+from typing import Any
 
 import jinja2
 import yaml
@@ -16,6 +13,10 @@ from reconcile.status import ExitCodes
 from reconcile.utils import gql
 from reconcile.utils.defer import defer
 from reconcile.utils.openshift_resource import OpenshiftResource as OR
+from reconcile.utils.parse_dhms_duration import (
+    dhms_to_seconds,
+    seconds_to_hms,
+)
 from reconcile.utils.saasherder import Providers
 from reconcile.utils.semver_helper import make_semver
 from reconcile.utils.sharding import is_in_shard
@@ -27,6 +28,10 @@ QONTRACT_INTEGRATION_VERSION = make_semver(0, 1, 0)
 # it must be a single character due to resource max length
 OBJECTS_PREFIX = "o"
 RESOURCE_MAX_LENGTH = 63
+# This is caused by PipelineRun names on retry. They get the name pipeline-<7 random characters>
+# If pipeline names are larger than this, PR will fail to get created as names will be larger
+# than 63 characters.
+PIPELINE_MAX_LENGTH = RESOURCE_MAX_LENGTH - 7
 
 # Defaults
 DEFAULT_DEPLOY_RESOURCES_STEP_NAME = "qontract-reconcile"
@@ -44,6 +49,7 @@ SAAS_FILES_QUERY = """
       name
       provider
     }
+    timeout
     deployResources {
       requests {
         cpu
@@ -67,7 +73,7 @@ class OpenshiftTektonResourcesBadConfigError(Exception):
     pass
 
 
-def fetch_saas_files(saas_file_name: Optional[str]) -> list[dict[str, Any]]:
+def fetch_saas_files(saas_file_name: str | None) -> list[dict[str, Any]]:
     """Fetch saas v2 files"""
     saas_files = gql.get_api().query(SAAS_FILES_QUERY)["saas_files"]
 
@@ -83,7 +89,7 @@ def fetch_saas_files(saas_file_name: Optional[str]) -> list[dict[str, Any]]:
     return saas_files
 
 
-def fetch_tkn_providers(saas_file_name: Optional[str]) -> dict[str, Any]:
+def fetch_tkn_providers(saas_file_name: str | None) -> dict[str, Any]:
     """Fetch tekton providers data for the saas files handled here"""
     saas_files = fetch_saas_files(saas_file_name)
     if not saas_files:
@@ -127,8 +133,8 @@ def fetch_tkn_providers(saas_file_name: Optional[str]) -> dict[str, Any]:
 
 
 def fetch_desired_resources(
-    tkn_providers: dict[str, Any]
-) -> list[dict[str, Union[str, OR]]]:
+    tkn_providers: dict[str, Any],
+) -> list[dict[str, str | OR]]:
     """Create an array of dicts that will be used as args of ri.add_desired
     This will also add resourceNames inside tkn_providers['namespace']
     while we are migrating from the current system to this integration"""
@@ -203,7 +209,7 @@ def fetch_desired_resources(
 
 
 def build_one_per_namespace_task(
-    task_template_config: dict[str, str]
+    task_template_config: dict[str, str],
 ) -> dict[str, Any]:
     """Builds onePerNamespace Task objects. The name of the task template
     will be used as Task name and there won't be any resource configuration"""
@@ -220,6 +226,22 @@ def build_one_per_namespace_task(
     return task
 
 
+def _curate_deploy_resources(deploy_resources: Mapping[str, Any]) -> dict[str, Any]:
+    """Removes empty (None) values in deploy_resources dicts
+
+    :param deploy_resources: dictionary with the resources returned by Gql
+    :return: dict with the resources without None values
+    """
+    resources = {
+        item: {
+            k: v for k, v in (deploy_resources.get(item) or {}).items() if v is not None
+        }
+        for item, values in deploy_resources.items()
+        if values is not None
+    }
+    return resources
+
+
 def build_one_per_saas_file_task(
     task_template_config: dict[str, str],
     saas_file: dict[str, Any],
@@ -236,7 +258,7 @@ def build_one_per_saas_file_task(
         else {}
     )
     task = load_tkn_template(task_template_config["path"], variables)
-    task["metadata"]["name"] = build_one_per_saas_file_tkn_object_name(
+    task["metadata"]["name"] = build_one_per_saas_file_tkn_task_name(
         task_template_config["name"], saas_file["name"]
     )
     step_name = task_template_config.get(
@@ -246,7 +268,9 @@ def build_one_per_saas_file_task(
     resources_configured = False
     for step in task["spec"]["steps"]:
         if step["name"] == step_name:
-            step["resources"] = saas_file.get("deployResources") or deploy_resources
+            step["computeResources"] = _curate_deploy_resources(
+                saas_file.get("deployResources") or deploy_resources
+            )
             resources_configured = True
             break
 
@@ -272,10 +296,15 @@ def build_one_per_saas_file_pipeline(
         else {}
     )
     pipeline = load_tkn_template(pipeline_template_config["path"], variables)
-    pipeline["metadata"]["name"] = build_one_per_saas_file_tkn_object_name(
+    pipeline["metadata"]["name"] = build_one_per_saas_file_tkn_pipeline_name(
         pipeline_template_config["name"], saas_file["name"]
     )
 
+    timeout = saas_file.get("timeout")
+    if timeout:
+        timeout_seconds = dhms_to_seconds(timeout)
+        normalized_timeout = seconds_to_hms(timeout_seconds)
+
     for section in ["tasks", "finally"]:
         for task in pipeline["spec"].get(section, []):
             if task["name"] not in task_templates_types:
@@ -289,10 +318,13 @@ def build_one_per_saas_file_pipeline(
                     task["name"]
                 )
             else:
-                task["taskRef"]["name"] = build_one_per_saas_file_tkn_object_name(
+                task["taskRef"]["name"] = build_one_per_saas_file_tkn_task_name(
                     task["name"], saas_file["name"]
                 )
 
+            if timeout:
+                task["timeout"] = normalized_timeout
+
     return pipeline
 
 
@@ -308,7 +340,7 @@ def load_tkn_template(path: str, variables: dict[str, str]) -> dict[str, Any]:
 
 def build_desired_resource(
     tkn_object: dict[str, Any], path: str, cluster: str, namespace: str
-) -> dict[str, Union[str, OR]]:
+) -> dict[str, str | OR]:
     """Returns a dict with ResourceInventory.add_desired args"""
     openshift_resource = OR(
         tkn_object,
@@ -331,7 +363,16 @@ def check_resource_max_length(name: str) -> None:
     being applied"""
     if len(name) > RESOURCE_MAX_LENGTH:
         raise OpenshiftTektonResourcesNameTooLongError(
-            f"name {name} is longer than {RESOURCE_MAX_LENGTH} characters"
+            f"Resource name {name} is longer than {RESOURCE_MAX_LENGTH} characters"
+        )
+
+
+def check_pipeline_max_length(name: str) -> None:
+    """Checks the pipeline name is not too long as it may have problems when
+    used to generate PipelineRun names on retry"""
+    if len(name) > PIPELINE_MAX_LENGTH:
+        raise OpenshiftTektonResourcesNameTooLongError(
+            f"Pipeline name {name} is longer than {PIPELINE_MAX_LENGTH} characters"
         )
 
 
@@ -342,13 +383,36 @@ def build_one_per_namespace_tkn_object_name(name: str) -> str:
     return name
 
 
-def build_one_per_saas_file_tkn_object_name(
+def _generate_one_per_saas_file_tkn_object_name(
+    template_name: str, saas_file_name: str
+) -> str:
+    """Generates a onePerSaasFile object name.  Given a saas file name, it returns the
+    openshift-saas-deploy names used by Tasks and Pipelines created by this integration
+    """
+    return f"{OBJECTS_PREFIX}-{template_name}-{saas_file_name}"
+
+
+def build_one_per_saas_file_tkn_pipeline_name(
+    template_name: str, saas_file_name: str
+) -> str:
+    """Builds a onePerSaasFile pipeline name and checks length. Given a saas file name,
+    it returns the openshift-saas-deploy names used by Pipelines created by this
+    integration.  Pipeline lenghth is further limited by the fact that PipelineRuns
+    that are create as part of a retry have the name of the Pipeline + 7 random
+    characters and they have a max lenght of 63 characters.
+    """
+    name = _generate_one_per_saas_file_tkn_object_name(template_name, saas_file_name)
+    check_pipeline_max_length(name)
+    return name
+
+
+def build_one_per_saas_file_tkn_task_name(
     template_name: str, saas_file_name: str
 ) -> str:
-    """Builds a onePerSaasFile object name.  Given a saas file name, it returns
-    the openshift-saas-deploy names used by Tasks and Pipelines created by this
-    integration"""
-    name = f"{OBJECTS_PREFIX}-{template_name}-{saas_file_name}"
+    """Builds a onePerSaasFile task name and checks length. Given a saas file name, it
+    returns the openshift-saas-deploy names used by Tasks created by this integration
+    """
+    name = _generate_one_per_saas_file_tkn_object_name(template_name, saas_file_name)
     check_resource_max_length(name)
     return name
 
@@ -356,11 +420,10 @@ def build_one_per_saas_file_tkn_object_name(
 def run(
     dry_run: bool,
     thread_pool_size: int = 10,
-    internal: Optional[bool] = None,
+    internal: bool | None = None,
     use_jump_host: bool = True,
-    saas_file_name: Optional[str] = None,
+    saas_file_name: str | None = None,
 ) -> None:
-
     tkn_providers = fetch_tkn_providers(saas_file_name)
 
     # TODO: This will need to be an error condition in the future
@@ -392,6 +455,8 @@ def run(
     for desired_resource in desired_resources:
         ri.add_desired(**desired_resource)
 
+    LOG.debug("Publishing metrics")
+    ob.publish_metrics(ri, QONTRACT_INTEGRATION)
     LOG.debug("Realizing data")
     ob.realize_data(dry_run, oc_map, ri, thread_pool_size)
 

reconcile/openshift_upgrade_watcher.py

@@ -4,8 +4,8 @@ from collections.abc import (
     Iterable,
 )
 from datetime import datetime
-from typing import Optional
 
+from reconcile import queries
 from reconcile.gql_definitions.common.clusters import ClusterV1
 from reconcile.slack_base import slackapi_from_queries
 from reconcile.typed_queries.app_interface_vault_settings import (
@@ -18,6 +18,9 @@ from reconcile.utils.oc_map import (
     OCMap,
     init_oc_map_from_clusters,
 )
+from reconcile.utils.ocm import OCMMap
+from reconcile.utils.ocm.upgrades import get_control_plane_upgrade_policies
+from reconcile.utils.ocm_base_client import OCMBaseClient
 from reconcile.utils.secret_reader import create_secret_reader
 from reconcile.utils.slack_api import SlackApi
 from reconcile.utils.state import (
@@ -28,7 +31,7 @@ from reconcile.utils.state import (
 QONTRACT_INTEGRATION = "openshift-upgrade-watcher"
 
 
-def cluster_slack_handle(cluster: str, slack: Optional[SlackApi]) -> str:
+def cluster_slack_handle(cluster: str, slack: SlackApi | None) -> str:
     usergroup = f"{cluster}-cluster"
     usergroup_id = f"@{usergroup}"
     if slack:
@@ -38,10 +41,10 @@ def cluster_slack_handle(cluster: str, slack: Optional[SlackApi]) -> str:
 
 def handle_slack_notification(
     msg: str,
-    slack: Optional[SlackApi],
+    slack: SlackApi | None,
     state: State,
     state_key: str,
-    state_value: Optional[str],
+    state_value: str | None,
 ) -> None:
     """Check notification status, notify if needed and update the notification status"""
     if state.exists(state_key) and state.get(state_key) == state_value:
@@ -54,86 +57,121 @@ def handle_slack_notification(
     state.add(state_key, state_value, force=True)
 
 
+def _get_start_osd(oc_map: OCMap, cluster_name: str) -> tuple[str | None, str | None]:
+    oc = oc_map.get(cluster_name)
+    if isinstance(oc, OCLogMsg):
+        logging.log(level=oc.log_level, msg=oc.message)
+        return None, None
+
+    upgrade_config = oc.get(
+        namespace="openshift-managed-upgrade-operator",
+        kind="UpgradeConfig",
+        allow_not_found=True,
+    )["items"]
+    if not upgrade_config:
+        logging.debug(f"[{cluster_name}] UpgradeConfig not found.")
+        return None, None
+    [upgrade_config] = upgrade_config
+
+    upgrade_spec = upgrade_config["spec"]
+    upgrade_at = upgrade_spec["upgradeAt"]
+    version = upgrade_spec["desired"]["version"]
+    return upgrade_at, version
+
+
+def _get_start_hypershift(
+    ocm_api: OCMBaseClient, cluster_id: str
+) -> tuple[str | None, str | None]:
+    schedules = get_control_plane_upgrade_policies(ocm_api, cluster_id)
+    schedule = [s for s in schedules if s["state"] == "started"]
+    if not schedule:
+        return None, None
+
+    if len(schedule) > 1:
+        logging.error(f"[{cluster_id}] More than one schedule started.")
+
+    return schedule[0]["next_run"], schedule[0]["version"]
+
+
 def notify_upgrades_start(
+    clusters: list[ClusterV1],
     oc_map: OCMap,
+    ocm_map: OCMMap,
     state: State,
-    slack: Optional[SlackApi],
+    slack: SlackApi | None,
 ) -> None:
     now = datetime.utcnow()
-    for cluster in oc_map.clusters(include_errors=True):
-        oc = oc_map.get(cluster)
-        if isinstance(oc, OCLogMsg):
-            logging.log(level=oc.log_level, msg=oc.message)
-            continue
-        upgrade_config = oc.get(
-            namespace="openshift-managed-upgrade-operator",
-            kind="UpgradeConfig",
-            allow_not_found=True,
-        )["items"]
-        if not upgrade_config:
-            logging.debug(f"[{cluster}] UpgradeConfig not found.")
+    for cluster in clusters:
+        if cluster.spec and not cluster.spec.hypershift:
+            upgrade_at, version = _get_start_osd(oc_map, cluster.name)
+        elif cluster.spec and cluster.spec.q_id:
+            upgrade_at, version = _get_start_hypershift(
+                ocm_map.get(cluster.name)._ocm_client, cluster.spec.q_id
+            )
+        else:
             continue
-        [upgrade_config] = upgrade_config
-
-        upgrade_spec = upgrade_config["spec"]
-        upgrade_at = upgrade_spec["upgradeAt"]
-        version = upgrade_spec["desired"]["version"]
-        upgrade_at_obj = datetime.strptime(upgrade_at, "%Y-%m-%dT%H:%M:%SZ")
-        state_key = f"{cluster}-{upgrade_at}"
-        # if this is the first iteration in which 'now' had passed
-        # the upgrade at date time, we send a notification
-        if upgrade_at_obj < now:
+
+        if upgrade_at and version:
+            upgrade_at_obj = datetime.strptime(upgrade_at, "%Y-%m-%dT%H:%M:%SZ")
+            state_key = f"{cluster.name}-{upgrade_at}1"
+            # if this is the first iteration in which 'now' had passed
+            # the upgrade at date time, we send a notification
+            if upgrade_at_obj < now:
+                msg = (
+                    f"Heads up {cluster_slack_handle(cluster.name, slack)}! "
+                    + f"cluster `{cluster.name}` is currently "
+                    + f"being upgraded to version `{version}`"
+                )
+                handle_slack_notification(
+                    msg=msg,
+                    slack=slack,
+                    state=state,
+                    state_key=state_key,
+                    state_value=None,
+                )
+
+
+def notify_cluster_new_version(
+    clusters: Iterable[ClusterV1], state: State, slack: SlackApi | None
+) -> None:
+    # Send a notification, if a cluster runs a version it was not running in the past
+    # This does not check if an upgrade was successful or not
+    for cluster in clusters:
+        if cluster.spec:
+            state_key = f"{cluster.name}-{cluster.spec.version}"
             msg = (
-                f"Heads up {cluster_slack_handle(cluster, slack)}! "
-                + f"cluster `{cluster}` is currently "
-                + f"being upgraded to version `{version}`"
+                f"{cluster_slack_handle(cluster.name, slack)}: "
+                + f"cluster `{cluster.name}` is now running version `{cluster.spec.version}`"
             )
             handle_slack_notification(
-                msg=msg, slack=slack, state=state, state_key=state_key, state_value=None
+                msg=msg,
+                slack=slack,
+                state=state,
+                state_key=state_key,
+                state_value=cluster.spec.version,
             )
 
 
-def notify_upgrades_done(
-    clusters: Iterable[ClusterV1], state: State, slack: Optional[SlackApi]
-) -> None:
-    for cluster in clusters:
-        if not cluster.spec:
-            raise RuntimeError(f"Cluster '{cluster.name}' does not have any spec.")
-        state_key = f"{cluster.name}-{cluster.spec.version}"
-        msg = (
-            f"{cluster_slack_handle(cluster.name, slack)}: "
-            + f"cluster `{cluster.name}` is now running version `{cluster.spec.version}`"
-        )
-        handle_slack_notification(
-            msg=msg,
-            slack=slack,
-            state=state,
-            state_key=state_key,
-            state_value=cluster.spec.version,
-        )
-
-
 @defer
 def run(
     dry_run: bool,
     thread_pool_size: int = 10,
-    internal: Optional[bool] = None,
+    internal: bool | None = None,
     use_jump_host: bool = True,
-    defer: Optional[Callable] = None,
+    defer: Callable | None = None,
 ) -> None:
+    slack: SlackApi | None = None
+    if not dry_run:
+        slack = slackapi_from_queries(QONTRACT_INTEGRATION)
+
     vault_settings = get_app_interface_vault_settings()
+    settings = queries.get_app_interface_settings()
     secret_reader = create_secret_reader(use_vault=vault_settings.vault)
     state = init_state(integration=QONTRACT_INTEGRATION, secret_reader=secret_reader)
     if defer:
         defer(state.cleanup)
 
-    clusters = [
-        c for c in get_clusters() if c.ocm and not (c.spec and c.spec.hypershift)
-    ]
-
-    slack: Optional[SlackApi] = None
-    if not dry_run:
-        slack = slackapi_from_queries(QONTRACT_INTEGRATION)
+    clusters = [c for c in get_clusters() if c.ocm and c.spec]
 
     oc_map = init_oc_map_from_clusters(
         clusters=clusters,
@@ -145,6 +183,16 @@ def run(
     )
     if defer:
         defer(oc_map.cleanup)
-    notify_upgrades_start(oc_map=oc_map, state=state, slack=slack)
 
-    notify_upgrades_done(clusters=clusters, state=state, slack=slack)
+    cluster_like_objects = [cluster.dict(by_alias=True) for cluster in clusters]
+    ocm_map = OCMMap(
+        clusters=cluster_like_objects,
+        integration=QONTRACT_INTEGRATION,
+        settings=settings,
+    )
+
+    notify_upgrades_start(
+        clusters=clusters, oc_map=oc_map, ocm_map=ocm_map, state=state, slack=slack
+    )
+
+    notify_cluster_new_version(clusters=clusters, state=state, slack=slack)

reconcile/openshift_users.py

@@ -5,10 +5,7 @@ from collections.abc import (
     Iterable,
     Mapping,
 )
-from typing import (
-    Any,
-    Optional,
-)
+from typing import Any
 
 from sretoolbox.utils import threaded
 
@@ -18,6 +15,7 @@ from reconcile import (
 )
 from reconcile.gql_definitions.common.clusters_minimal import (
     ClusterAuthOIDCV1,
+    ClusterAuthRHIDPV1,
     ClusterV1,
 )
 from reconcile.typed_queries.app_interface_vault_settings import (
@@ -45,13 +43,13 @@ def get_cluster_users(
     users: list[str] = []
 
     # get cluster info for current cluster name from clusters list
-    cluster_info = next((cl for cl in clusters if cl.name == cluster))
+    cluster_info = next(cl for cl in clusters if cl.name == cluster)
 
     # backwarts compatibiltiy for clusters w/o auth
     identity_prefixes = ["github"]
 
     for auth in cluster_info.auth:
-        if isinstance(auth, ClusterAuthOIDCV1):
+        if isinstance(auth, ClusterAuthOIDCV1 | ClusterAuthRHIDPV1):
             identity_prefixes.append(auth.name)
 
     for u in oc.get_users():
@@ -71,7 +69,7 @@ def get_cluster_users(
 
 def fetch_current_state(
     thread_pool_size: int,
-    internal: Optional[bool],
+    internal: bool | None,
     use_jump_host: bool,
 ) -> tuple[OCMap, list[Any]]:
     vault_settings = get_app_interface_vault_settings()
@@ -98,7 +96,7 @@ def fetch_current_state(
 
 
 def fetch_desired_state(
-    oc_map: Optional[OCMap], enforced_user_keys: Any = None
+    oc_map: OCMap | None, enforced_user_keys: Any = None
 ) -> list[Any]:
     desired_state = []
 
@@ -108,7 +106,8 @@ def fetch_desired_state(
     desired_state.extend(flat_rolebindings_desired_state)
 
     groups_desired_state = openshift_groups.fetch_desired_state(
-        oc_map, enforced_user_keys=enforced_user_keys
+        clusters=oc_map.clusters() if oc_map else [],
+        enforced_user_keys=enforced_user_keys,
     )
     flat_groups_desired_state = [
         {"cluster": s["cluster"], "user": s["user"]} for s in groups_desired_state
@@ -141,9 +140,11 @@ def subtract_states(
             found = True
             break
         if not found:
-            result.append(
-                {"action": action, "cluster": f_user["cluster"], "user": f_user["user"]}
-            )
+            result.append({
+                "action": action,
+                "cluster": f_user["cluster"],
+                "user": f_user["user"],
+            })
 
     return result
 
@@ -159,16 +160,16 @@ def act(diff: Mapping[str, Any], oc_map: OCMap) -> None:
             raise Exception("No proper Openshift Client for del_user operation")
         oc.delete_user(user)
     else:
-        raise Exception("invalid action: {}".format(action))
+        raise Exception(f"invalid action: {action}")
 
 
 @defer
 def run(
     dry_run: bool,
     thread_pool_size: int = 10,
-    internal: Optional[bool] = None,
+    internal: bool | None = None,
     use_jump_host: bool = True,
-    defer: Optional[Callable] = None,
+    defer: Callable | None = None,
 ) -> None:
     oc_map, current_state = fetch_current_state(
         thread_pool_size, internal, use_jump_host

reconcile/openshift_vault_secrets.py

@@ -1,7 +1,9 @@
+from collections import defaultdict
 from typing import Any
 
+from deepdiff import DeepHash
+
 import reconcile.openshift_resources_base as orb
-from reconcile.change_owners.diff import IDENTIFIER_FIELD_NAME
 from reconcile.utils.runtime.integration import DesiredStateShardConfig
 from reconcile.utils.semver_helper import make_semver
 
@@ -36,12 +38,15 @@ def run(
 def early_exit_desired_state(*args, **kwargs) -> dict[str, Any]:
     namespaces, _ = orb.get_namespaces(PROVIDERS)
 
-    def add_ns_identify(ns):
-        ns[IDENTIFIER_FIELD_NAME] = f"{ns['cluster']['name']}/{ns['name']}"
-        return ns
+    state_for_clusters = defaultdict(list)
+    for ns in namespaces:
+        state_for_clusters[ns["cluster"]["name"]].append(ns)
 
     return {
-        "namespaces": [add_ns_identify(ns) for ns in namespaces],
+        "state": {
+            cluster: {"shard": cluster, "hash": DeepHash(state).get(state)}
+            for cluster, state in state_for_clusters.items()
+        }
     }
 
 
@@ -49,7 +54,7 @@ def desired_state_shard_config() -> DesiredStateShardConfig:
     return DesiredStateShardConfig(
         shard_arg_name="cluster_name",
         shard_path_selectors={
-            "namespaces[*].cluster.name",
+            "state.*.shard",
         },
         sharded_run_review=lambda proposal: len(proposal.proposed_shards) <= 2,
     )